Introduction
Opening a network service is only half of the administration task. You must also control which traffic the host firewall allows. On Red Hat systems, firewalld manages firewall policy through zones, services, ports, and rich rules.
In this lab, a small HTTP service is prepared for you on TCP port 8088. You will inspect the default zone, open the port at runtime, make the rule permanent, replace the broad port opening with a source-restricted rich rule, and audit the final firewall state.
Inspect Firewall and Service Baseline
In this step, you will inspect the current firewalld state and the prepared network service. The firewall should be running before you change rules.
The setup permanently preserves SSH and the LabEx browser terminal on 3002/tcp in the public zone. Keep these management rules while changing the application firewall policy.
Move into the project directory.
cd /home/labex/project
Check that firewalld is running. In this environment, use sudo firewall-cmd for both read and write operations.
sudo firewall-cmd --state
Show the default zone.
sudo firewall-cmd --get-default-zone
Inspect the active zone. Notice that ssh is allowed so the LabEx SSH session remains reachable.
sudo firewall-cmd --list-all
Confirm the practice web service is running and listening on port 8088.
systemctl is-active rhcsa-fw-web.service
ss -ltn | grep ':8088'
curl -s http://127.0.0.1:8088/
Check that port 8088/tcp is not broadly open in firewalld yet.
sudo firewall-cmd --query-port=8088/tcp || echo "port 8088 is not open in the zone"
Open a Runtime Port
In this step, you will add a runtime firewall rule. Runtime rules take effect immediately but disappear after firewalld reloads unless you also make them permanent.
Open TCP port 8088 in the current runtime configuration. Because no zone is specified, firewall-cmd applies the change to the default zone you inspected earlier.
sudo firewall-cmd --add-port=8088/tcp
Query the runtime rule. A result of yes means the active firewall currently allows the port.
sudo firewall-cmd --query-port=8088/tcp
List runtime ports. This gives you a compact view of manually opened ports in the active zone.
sudo firewall-cmd --list-ports
Check the permanent configuration. It should still report no because runtime and permanent configuration are separate; a runtime-only rule works now but would be lost when firewalld reloads.
sudo firewall-cmd --permanent --query-port=8088/tcp || echo "port 8088 is not permanent yet"
Make the Port Rule Permanent
In this step, you will add the same port to the permanent configuration and reload firewalld. Reloading applies permanent configuration to the runtime firewall.
Add the permanent port rule. The --permanent option writes the rule to firewalld configuration instead of only changing the running firewall.
sudo firewall-cmd --permanent --add-port=8088/tcp
Reload firewalld. Reloading rebuilds the runtime firewall from the permanent configuration, which is why this step tests whether your saved rule can survive a reload.
sudo firewall-cmd --reload
Query both runtime and permanent configuration. The first command checks the active firewall, and the second checks the saved configuration.
sudo firewall-cmd --query-port=8088/tcp
sudo firewall-cmd --permanent --query-port=8088/tcp
Both commands should return yes.
Replace the Open Port with a Rich Rule
In this step, you will restrict access instead of leaving the service open to every source. A rich rule can include a source address and a destination port in one rule.
Remove the broad permanent port opening. This prepares the firewall for a narrower rule; otherwise the rich rule would be present, but the broad port rule would still allow every source.
sudo firewall-cmd --permanent --remove-port=8088/tcp
Add a rich rule that allows 8088/tcp only from the documentation network 192.0.2.0/24. Rich rules are useful when a simple service or port rule is not specific enough, such as when source address restrictions are required.
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.0.2.0/24" port port="8088" protocol="tcp" accept'
Reload firewalld to apply the permanent change.
sudo firewall-cmd --reload
Confirm the broad port is no longer open. The expected no result means the service is no longer exposed by a general port rule.
sudo firewall-cmd --query-port=8088/tcp || echo "broad port rule removed"
List rich rules. The rich rule output is the evidence that the narrower source-based rule replaced the broad opening.
sudo firewall-cmd --list-rich-rules
Audit the Final Firewall State
In this step, you will audit the final state. Final verification is an important administration habit: confirm the service is running, SSH remains allowed, the broad port is closed, and the restricted rule exists.
List the active zone.
sudo firewall-cmd --list-all
List permanent rich rules.
sudo firewall-cmd --permanent --list-rich-rules
Confirm SSH is still allowed.
sudo firewall-cmd --query-service=ssh
Confirm the service itself still responds locally. Local loopback access verifies the service process; firewalld controls inbound zone traffic separately.
curl -s http://127.0.0.1:8088/
Summary
You practiced host firewall administration with firewalld. You inspected the default zone, confirmed a network service was running, added a runtime port rule, made a rule permanent, reloaded firewalld, replaced a broad opening with a source-restricted rich rule, and audited the final firewall state.
